API Access Control Bypass in Outline Document Collaboration Service
CVE-2026-54573

5.3MEDIUM

Key Information:

Vendor

Outline

Status
Outline
Vendor
CVE Published:
25 June 2026

What is CVE-2026-54573?

Outline is a collaborative documentation service that suffered from an authentication bypass vulnerability due to improper URL fragment handling. Prior to version 1.8.0, the AuthenticationHelper.canAccess function incorrectly utilized ctx.originalUrl to validate API key or OAuth token scopes. This flaw allowed malicious actors to append a fragment to a restricted API endpoint, tricking the access control mechanism into granting unintended permissions. As a result, attackers could escalate privileges without proper authorization. The vulnerability was patched in version 1.8.0.

Affected Version(s)

outline < 1.8.0

References

https://github.com/outline/outline/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.